CVE-2026-122190: SourceCodester Online Food Ordering System Category Management add_category.php cross site scripting
A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/addcategory.php of the component Category Management. Performing a manipulation of the argument categorytitle results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Administrators or other users who can access Category Management in SourceCodester Online Food Ordering System 1.0 are the relevant exposure group. Exploitation requires high privileges and user interaction.
What input should be checked during triage?
Review requests to admin/add_category.php that supply the category_title argument. The reported issue is triggered by manipulating that parameter.
Is exploitation likely to require a remote attacker?
The attack can be initiated remotely, but the vector rating indicates it requires high privileges and user interaction. Public exploit information is available.